The present invention is generally directed to the Windows Portable Devices (WPD) architecture. In particular, the present invention provides a mechanism to classify and manage WPD devices based on the device's capabilities. This mechanism can be employed when the device is locally connected or redirected in a virtual desktop infrastructure (VDI) environment.
The WPD specification is a superset of the Media Transfer Protocol (MTP). WPD enables computers to communicate with attached media and storage devices. As a primary example, when a smart phone is connected to a Windows computer, applications on the computer can use WPD to communicate with the smart phone for the purpose of accessing the different functionalities provided by the smart phone (e.g., storage, SMS, contacts, etc.).
FIG. 1 provides an overview of the WPD architecture on a computer 100. The WPD architecture can generally be divided into three processes: application 101, WPD host process 110, and I/O stack (or kernel mode driver(s)) 120. Application 101 employs the WPD API 102 to communicate with the appropriate WPD driver 111. This communication is carried out via serializers 102a/102b (e.g., to pack or unpack parameters to or from Windows Driver Foundation (WDF) User Mode Driver Framework (UMDF) buffers). WPD driver 111 employs I/O to process WPD messages it receives from WPD API 102. In essence, WPD driver 111 functions as a middleman between application 101 and I/O stack 120. I/O stack 120 will vary depending on the transport required by WPD device 150. For example, WPD device 150 could be connected to computer 100 via IP, Bluetooth, or USB and could employ the MTP, PTP, or MSC protocols.
The primary benefit of WPD is that it provides a common representation of WPD devices even though these devices may vary drastically. This common representation is structured as a hierarchy of objects. At the top of the hierarchy is the device object which represents the device itself. The next level of the hierarchy includes functional objects which each represent a function or capability provided by the device. For example, the object hierarchy of a standard smart phone may include a storage object, a contacts service object, and an SMS service object. Below these functional objects, there may be a number of content objects such as media object under the storage object, contact objects under the contacts service object, and messages under the SMS service object. WPD API 102 provides a number of functions for identifying which objects (or functions and/or content) a WPD device provides and which properties these objects have, as well as for accessing these objects. Again, WPD API 102 provides a common interface through which this can be accomplished.
Because the present invention can be implemented in cases where a WPD device is connected to a computer via device redirection, an overview of how device redirection can be accomplished will be provided. Device redirection generally refers to making a device that is connected to a client accessible within a virtual desktop as if the device had been physically connected to the virtual desktop. In other words, when device redirection is implemented, a user can connect a device to his or her client terminal and the device will function as if it had been connected to the server.
FIGS. 2 and 3 and the following description will provide a general overview of how USB device redirection can be implemented in accordance with some embodiments of the present invention. In FIG. 2, a computing system 200 is depicted as including a number of client terminals 202a-202n (referenced generally herein as client(s) 202) in communication with a server 204 via a network 206. Server 204 can be configured to support a remote session (e.g., a remote desktop session) wherein a user at a client 202 can remotely access applications and data at the server 204 from the client 202. Such a connection may be established using any of several well-known techniques such as the Remote Desktop Protocol (RDP) and the Citrix® Independent Computing Architecture (ICA).
Client terminal 202 may represent a computer, a mobile phone (e.g., smart phone), a laptop computer, a thin client terminal, a personal digital assistant (PDA), a portable computing terminal, or a suitable terminal or device with a processor. Server 204 may represent a computer, a laptop computer, a computing terminal, a virtual machine (e.g., VMware® Virtual Machine), a desktop session (e.g., Microsoft Terminal Server), a published application (e.g., Microsoft Terminal Server) or a suitable terminal with a processor.
Client 202 may initiate a remote session with server 204 by sending a request for remote access and credentials (e.g., login name and password) to server 204. If server 204 accepts the credentials from client 202, then server 204 may establish a remote session, which allows a user at client 202 to access applications and data at server 204. During the remote session, server 204 sends display data to client 202 over network 206, which may include display data of a desktop and/or one or more applications running on server 204. The desktop may include, for example, icons corresponding to different applications that can be launched on server 204. The display data allows client 202 to locally display the desktop and/or applications running on server 204.
During the remote session, client 202 may send user commands (e.g., inputted via a mouse or keyboard at client 202) to server 204 over network 206. Server 204 may process the user commands from client 202 similar to user commands received from an input device that is local to server 204. For example, if the user commands include mouse movements, then server 204 may move a pointer on the desktop running on server 204 accordingly. When the display data of the desktop and/or application changes in response to the user commands, server 204 sends the updated display data to client 202. Client 202 locally displays the updated display data so that the user at client 202 can view changes at server 204 in response to the user commands. Together, these aspects allow the user at client 202 to locally view and input commands to the desktop and/or application that is running remotely on server 204. From the perspective of the client side, the desktop running on server 204 may represent a virtual desktop environment.
FIG. 3 is a block diagram of a local device virtualization system 300 in accordance with embodiments of the present invention. System 300 may include client 202 in communication with server 204 over network 206 as illustrated in FIG. 2. Client 202 may include a proxy 210, a stub driver 220, and a bus driver 230. Client 202 can be connected to a device 240, as shown in FIG. 3. Server 204 may include an agent 250 and a virtual bus driver 260.
In accordance with USB device redirection techniques, while device 240 is not locally or physically connected to server 204 and is remote to server 204, device 240 appears to server 204 as if it is locally connected to server 204, as discussed further below. Thus, device 240 appears to server 204 as a virtual device 290.
By way of illustration and not limitation, device 240 may be any type of USB device including a machine-readable storage medium (e.g., flash storage device), a printer, a scanner, a camera, a facsimile machine, a phone, an audio device (e.g., a headset), a video device (e.g., a camera), a peripheral device, or other suitable device that can be connected to client 202. Device 240 may be an external device (i.e., external to client 202) or an internal device (i.e., internal to client 202). However, for purposes of the present invention, it can be assumed that device 240 is a WPD device.
Bus driver 230 can be configured to allow the operating system and programs of client 202 to interact with device 240. In one aspect, when device 240 is connected to client 202 (e.g., plugged into a port of client 202), bus driver 230 may detect the presence of device 240 and read information regarding device 240 (“device information”) from device 240. The device information may include features, characteristics and other information specific to device 240 such as a device descriptor (e.g., product ID, vendor ID and/or other information), a configuration descriptor, an interface descriptor, an endpoint descriptor and/or a string descriptor. Bus driver 230 may communicate with device 240 through a computer bus or other wired or wireless communications interface.
In accordance with USB device redirection techniques, device 240 may be accessed from server 204 as if the device were connected locally to server 240. Device 240 may be accessed from server 204 when client 202 is connected to server 204 through a user session running on server 204. For example, device 240 may be accessible from the desktop running on server 204 (i.e., virtual desktop environment). To enable this, bus driver 230 may be configured to load stub driver 220 as the default driver for device 240. Stub driver 220 may be configured to report the presence of device 240 to proxy 210 and to provide the device information (e.g., device descriptor) to proxy 210. Proxy 210 may be configured to report the presence of device 240, along with the device information, to agent 250 of server 204 over network 206. Thus, stub driver 220 redirects device 240 to server 204 via proxy 210.
Agent 250 may be configured to receive the report from proxy 210 that device 240 is connected to client 202 and the device information. Agent 250 may further be configured to associate with the report from proxy 210 one or more identifiers for client 202 and/or for a user session through which client 202 is connected to server 204, such as a session number or a session locally unique identifier (LUID). Agent 250 can provide notification of device 240, along with the device information, to virtual bus driver 260. Virtual bus driver 260 (which may be a TCX USB bus driver, or any other bus driver) may be configured to create and store in memory a record corresponding to device 240, the record including at least part of the device information and session identifiers received from agent 250. Virtual bus driver 260 may be configured to report to operating system 170 of server 204 that device 240 is connected and to provide the device information to the operating system. This allows the operating system of server 204 to recognize the presence of device 240 even though device 240 is connected to client 202.
The operating system of server 204 may use the device information to find and load one or more appropriate device drivers for device 240 at server 204. Each driver may have an associated device object (object(s) 281a, 281b, . . . , 281n, referred to generally as device object(s) 281), as illustratively shown in FIG. 3. A device object 281 is a software implementation of a real device 240 or a virtualized (or conceptual) device 290. Different device objects 281 layer over each other to provide the complete functionality. The different device objects 281 are associated with different device drivers (driver(s) 282a, 282b, . . . 282n, referred to generally as device driver(s) 282). In an example, a device 240 such as a USB flash drive may have associated device objects including objects corresponding to a USB driver, a storage driver, a volume manager driver, and a file system driver for the device. The device objects 281 corresponding to a same device 240 form a layered device stack 280 for device 240. For example, for a USB device, a USB bus driver will create a device object 281a stating that a new device has been plugged in. Next, a plug-and-play (PNP) component of the operating system will search for and load the best driver for device 240, which will create another device object 281b that is layered over the previous device object 281a. The layering of device objects 281 will create device stack 280. In the case where device 240 is a WPD device, device stack 280 can represent I/O stack 120 and operating system 170 can include WPD host process 110.
Device objects 281 may be stored in a memory of the server 204 associated with virtual bus driver 260. In particular, device objects 281 and resulting device stack 280 may be stored in random-access memory of server 204. Different devices 240/290 can have device stacks having different device objects and different numbers of device objects. The device stack may be ordered, such that lower level device objects (corresponding to lower level device drivers) have lower numbers than higher level device objects (corresponding to higher level device drivers). The device stack may be traversed downwards by traversing the stack from higher level objects to lower level objects. For example, in the case of an illustrative device stack 280 corresponding to a USB flash drive, the ordered device stack may be traversed downwards from a high-level file system driver device object, to a volume manager driver device object, to a storage driver device object, to a USB driver device object, and finally to a low-level virtual bus driver device object. Different device stacks 280 can be layered over each other to provide the functionality of the devices 240/290 inside devices, like USB Headsets, or USB pen drives. A USB pen drive, for example, can create a USB device stack first, over which it can create a storage device stack, where each of the device stacks have two or more device objects.
Once one or more device object(s) 281 are loaded by operating system 170 of server 204, each device object 281 can create a symbolic link (also referred to as a “device interface”) to device object 281 and associated device driver 282. The symbolic link is used by applications running on server 204 to access device object 281 and device 240/290. The symbolic link can be created by a call to a function such as IoCreateSymbolicLink( ) including such arguments as a name for the symbolic link, and a name of device object 281 or associated device 240. In one example, for example, a symbolic link to a USB flash drive device 240 is created by a call from a device object 281 for device 240 to the function IoCreateSymbolicLink( ) including arguments “\\GLOBAL?? \C:” (i.e., the name for the symbolic link) and “\Device\HarddiskVolume1” (i.e., a name of the device object).
The creation of a symbolic link results in an entry being created in an object manager namespace (OMN) of operating system 170. The OMN stores information on symbolic links created for and used by operating system 170, including symbolic links for devices 240, virtualized devices 290, and applications 270 running on server 204.
As a result of the symbolic link creation process, a symbolic link to device 240 is enumerated in the OMN of server 204. Once the presence of device 240 is reported to operating system 170 of server 204, device 240 may be accessible from a user session (and associated desktop) running on server 204 (i.e., virtual desktop environment). For example, device 240 may appear as an icon on the virtual desktop environment and/or may be accessed by applications running on server 204.
As was described above, in the case that device 240 is a WPD device, application 270 can represent application 101 and will therefore employ WPD API 102 to communicate with WPD device 150. In such a scenario, virtual bus driver 260 will be positioned at the bottom of I/O stack 120 and can perform the redirection techniques described above to cause WPD device 150 to appear as if it were connected locally to server 204.
There may be scenarios where it is desirable to prevent a user from connecting his or her WPD device to a computer. For example, an administrator may desire to prevent a user from being able to use his smartphone as a mass storage device when connected to his work computer (whether via a local session or remote session). Currently, this can be accomplished only by blocking the entire WPD device (e.g., via Active Directory Group Policy). Accordingly, if it were desired to still allow a user to access other (i.e., non-storage) capabilities of the WPD device, there would be no way to do so.